Chen Kirsch, Global Manager Consulting and Fraud Advisory
A year ago, I explored how fraudsters were using artificial intelligence to create synthetic identities, personalize phishing, impersonate trusted individuals, and scale deception. Looking back, the most consequential change is not simply what technology can do. It is who can now use it—and how little expertise they need. Capabilities that once required specialist knowledge, significant effort or access to technical teams are increasingly available through ready-made tools, commercial services and criminal marketplaces. Fraudsters no longer need to develop every capability themselves. They can now access, combine, and deploy tools that make sophisticated deception easier to execute and repeat at scale. The barrier is shifting from building technology to merely knowing how to use what is available. This distinction matters for financial institutions. The threat is not limited to a small number of technically advanced criminal groups. As the skills and effort required decline, sophisticated methods become accessible to a wider pool of offenders. Familiar fraud techniques can therefore become more consequential without being fundamentally new: deployed more widely, personalized more easily and repeated at greater scale. This article revisits the trends discussed last year through that lens: how greater accessibility is changing the practical use of AI by fraudsters, which capabilities are becoming easier to operationalize, and what financial institutions must do in response.
Synthetic Identities Become Synthetic Lives
Last year, I highlighted how fraudsters were using generative AI to create synthetic identities capable of bypassing traditional KYC controls. Since then, the problem has evolved beyond creating fake identities into creating entire synthetic lives. Criminal organizations now routinely generate:
Complete social media histories
AI-generated employment records
Fabricated educational backgrounds
Synthetic references and endorsements
Artificial digital footprints spanning multiple years
Rather than creating a fake applicant immediately before account opening, fraudsters increasingly "age" or “mature” synthetic identities over time, allowing them to establish credibility before attempting fraud. In some cases, AI agents actively maintain social media accounts, generate posts, and interact with other accounts to create authentic-seeming behavioral histories and patterns. These synthetic personas can now survive many traditional onboarding and due-diligence reviews. Recommended Mitigation Financial institutions should move beyond document-centric verification at onboarding and implement:
Network-based identity validation
Digital footprint consistency analysis
Behavioral biometrics
Cross-channel identity correlation
Consortium-based mule and synthetic identity intelligence sharing
Organizations should increasingly validate whether an identity behaves like a human over time, rather than solely validating whether submitted credentials are authentic.
Phishing Has Become Hyper-Personalized
The multilingual phishing attacks discussed last year have evolved into highly personalized fraud campaigns powered by Large Language Models. Modern phishing attacks no longer simply translate messages into the victim's native language. Instead, AI now customizes:
Writing style
Tone
Industry terminology
Corporate branding
Recent business events
Personal interests
Attackers increasingly use publicly available information, leaked data, and social media intelligence to construct messages that appear to come from trusted colleagues, suppliers, or banking partners. The days of poorly written phishing emails as a screening mechanism to filter out the “smart ones” are at an end. Recommended Mitigation Organizations should supplement employee awareness training with:
AI-driven phishing detection
Behavioral email analysis
Verification workflows for payment requests
Out-of-band confirmation processes
Domain and brand impersonation monitoring
Employee training must now focus on verification practices rather than spotting grammatical mistakes.
Voice Translation Has Evolved into Real-Time Fraud Conversation Engines
The emergence of AI-powered language translation enabled fraudsters to communicate across borders. Today, these technologies have matured into real-time fraud conversation engines. Modern AI systems can:
Translate conversations instantly
Adapt language based on victim responses
Predict effective persuasion techniques
Detect emotional cues
Recommend next-best responses to the fraudster
The result is a highly dynamic form of social engineering that resembles a call center operation powered by artificial intelligence. Fraudsters now conduct adaptive conversations capable of responding intelligently to objections and concerns. Recommended Mitigation The challenge is no longer detecting suspicious calls, but detecting sophisticated conversations designed to appear legitimate. Financial institutions should implement:
Voice-risk scoring
Real-time call monitoring
Enhanced transaction verification during high-risk interactions
Customer education regarding impersonation scams
Voice-biometrics combined with transaction-risk analytics
Deepfakes Have Moved Beyond Executive Impersonation
One year ago, deepfake attacks primarily focused on impersonating executives and trusted employees during high-value transactions. After rapid advancement,eepfakes have expanded into identity verification. Fraudsters are now attempting to defeat:
Remote onboarding processes
Video-based KYC checks
Customer support authentication
Password reset procedures
High-risk transaction approvals
The quality of real-time deepfake technology has improved significantly. Many attacks now incorporate synchronized voice, facial movement and emotional expression. The distinction between authentic and synthetic visual evidence continues to disappear. Organizations should increasingly assume that a convincing face or voice are no longer sufficient proof of identity. Recommended Mitigation Institutions should implement:
Liveness detection
Challenge-response authentication
Device intelligence
Behavioral biometrics
Multi-factor verification independent of video identity checks
AI-Powered Reconnaissance Is Becoming Autonomous
The reconnaissance capabilities whereby AI is used to collect information for fraudulent purposes described in the original article have advanced considerably. Fraudsters are increasingly using AI agents capable of:
Monitoring social media continuously
Tracking organizational changes
Identifying new employees
Detecting executiv teravel activity
Finding merger and acquisition announcements
Monitoring public filings
Criminal intelligence gathering is becoming automated and continuous rather than event driven. Instead of researching a victim before an attack, fraudsters increasingly maintain live intelligence databases that continuously update targeting information. Information that seems harmless individually can become highly dangerous when aggregated by AI systems. Recommended Mitigation Organizations should:
Reduce public exposure of sensitive information
Monitor executive digital footprints
Strengthen vendor verification procedures
Deploy AI-driven threat intelligence platforms
Regularly assess data exposure across public sources
Fake Merchants Have Evolved into Synthetic Businesses
Fake merchants have moved beyond fraudulent websites. Today, fraudsters can generate entire business ecosystems, including:
Product catalogs
Customer support agents
Reviews
Marketing campaigns
Social media channels
Corporate documentation
Some synthetic businesses appear more professional than legitimate small businesses. The rapid growth of AI-generated content has made it increasingly difficult for consumers, processors, and even investigators to distinguish between genuine and fabricated commercial entities. Future merchant risk assessments must verify operational legitimacy, not simply registration details. Recommended Mitigation Merchant onboarding should incorporate:
Enhanced beneficial ownership reviews
Supply-chain verification
Business activity monitoring
Website authenticity scoring
Network-based merchant relationship analysis
Adversarial AI Is Becoming an Industrialized Practice
The adversarial AI techniques discussed previously have become increasingly more organized. Fraud groups now routinely test controls through:
Automated fraud simulations
Synthetic transaction environments
AI-generated attack scenarios
Fraud model reverse engineering
In effect, organized fraud rings are developing their own fraud-testing laboratories. Many sophisticated groups use AI to identify threshold-based controls and optimize activity to avoid triggering alerts. Institutions that best understand how attackers test their systems will be best positioned to defend themselves. Recommended Mitigation Financial institutions should:
Move away from static thresholds
Deploy adaptive behavioral models
Use adversarial testing internally
Employ continuous model retraining
Adopt graph analytics and network detection techniques
New AI Threats That Have Rapidly Emerged
Beyond the threats identified last year, several new patterns of fraudulent AI usage are attracting attention. AI-Powered Account Takeover Agents Agents can now automate large portions of account takeover campaigns, including reconnaissance, credential testing, device emulation and social engineering. Synthetic Insider Threats Attackers are increasingly using AI-generated personas during hiring processes, particularly in remote-first environments. In some cases, synthetic applicants successfully gain access to sensitive systems. Generative Document Fraud Invoices, bank statements, tax documents, utility bills and supporting evidence can now be generated at an unprecedented level of realism. Fraud-as-a-Service Platforms Criminal marketplaces increasingly bundle AI capabilities into subscription services, enabling less sophisticated criminals to execute advanced attacks with minimal technical expertise.
Looking Ahead
A year ago, I described AI-enabled fraud as an emerging threat. Today, it is a fundamental component of the fraud ecosystem. The central lesson is not that fraudsters have discovered an entirely new technology. It is that capabilities once difficult to obtain or deploy are becoming easier to access, combine, and use. Technical sophistication is increasingly something offenders can acquire rather than develop themselves. That changes how financial institutions should assess the threat. A technique does not need to be new to become materially more dangerous. When the expertise and effort required to execute it fall, more offenders can attempt, adapt and repeat it. Accessibility turns a specialist’s capability into a broader operational risk. The response therefore requires more than another model or rule set, but a more end-to-end overarching approach. Financial institutions must assess whether their identity checks, payment-verification processes and detection controls remain effective when convincing documents, voices, messages and digital personas are easier to produce. Layered verification, behavioral and network analysis, intelligence sharing and continuous control testing become essential—not because every attack is autonomous, but because sophisticated deception is becoming less dependent on sophisticated attackers. What has changed is not just the technology. It is the accessibility. The challenge for defenders is anticipating what the most capable fraudsters can build and protecting people from a much wider pool of offenders.
